funneling a wireless net's outbound connections through tor

[Mike Cardwell]

Scott Bennett wrote:

>> 1.) People that can perform these attacks if you just use a normal 
>> Internet connection: Governments, people working for ISPs
> 
>      ...and anyone running a destination site being accessed with or
> without tor, and anyone with a wireless card in a laptop in the same
> public location, etc.

Ok. Add them to both lists then.

>> 2.) People that can perform these attacks if you use Tor: Governments, 
>> people working for ISPs and anyone who know how to install Tor. 
>> Including some wannabe hacker 13 year old kid living on the other side 
>> of the World.
>>
>      Governments are incomparably more dangerous than any 13-year-old or
> even ISPs.  Also, given the number of teenagers who have cracked well
> funded web servers, I'd say that said teenager is still not out of the loop
> without tor.

Cool. So we both agree that there are far more people that *can* attack 
you if you use Tor... Because option 1 is a subset of option 2, where 2 
has the extra group of people which we'll refer to as "everyone in the 
World"

You get attacked on Tor, simply for being a user of Tor. If you browse 
the Internet without taking appropriate precautions, when using Tor, you 
will be attacked eventually. You are creating this very environment for 
your users. You're not doing them a favour.

>> If you use Tor, you considerably increase the number and range of people 
>> that could potentially attack you. You also make yourself a tastier target.
>>
>> This is not a bad thing if you know how to deal with it. It *is* a bad 
>> thing if you don't. For example, I have only ever had attempted MITM 
>> attacks against my ssh sessions when using them over Tor.
>>
>>>>>      Aside from that, the only IP addresses that could conceivably be
>>>>> discovered would either be the one temporarily assigned to my connection
>>>>> or the one assigned on a private network by my wireless router via DHCP.
>>>>>      In any case, I still would appreciate helpful information, so I'll
>>>>> repeat my questions here, quoting from my original query:
>>>> The anonymity of the IP address is not at issue here. The issue is, by 
>>>> using Tor, you allow the possibility of exit nodes monitoring and 
>>>> modifying traffic, so you should only use Tor if you truly understand 
>>>> these issues and how to deal with them.
>>>      I see.  The elitist approach to limiting use of damned good software.
>>> Reminds me of David Sternlight claiming that there was no reason for anyone
>>> to use PGP and therefore people shouldn't bother with it.  It was ridiculous
>>> on its face, yet he persisted in trolling the PGP news groups with it for
>>> years.  Do you work for the NSA by any chance?  (Like you would really say
>>> so if you did.  Right.)
>> Your interpretation of what I said is quite hilarious.
> 
>       That line would certainly be in character for Sternlight.

It is absolutely true though. I said:

	How you want to use Tor is dangerous, and here is why.

You seemed to interpreted it as:

	No one should ever use Tor, oh noes!!!

You then reacted by accusing me of being both a Troll, and of working 
for the NSA. The words, "conspiracy nut," come to mind.

>> Hopefully nobody will help you use Tor for something that is dangerous 
>> and that you clearly don't understand. For your users sake.
>>
>      I understand it fine.  I just evaluate the dangers differently from
> you.  Not using tor at all is far more dangerous in my view.

Your view is crazy. You'd rather trust random anonymous people from all 
over the World to deliver "clean" traffic to you than your 
ISP/Government? Fair enough if you think your government or ISP has a 
reason to do it but it sounds to me like the only reason you're using 
tor for this particular project is:

1.) You want to give Internet access to people who don't want to pay for
     their own.
2.) You don't want to be connected with any dodgy traffic they might
     generate.

>      If it worries you so much, then I guess you need to convince the tor
> development team to remove the support for TransPort and DNSPort.

Why? They can be used in a perfectly safe way by people who know how to 
access the Tor network safely.

> Maybe you should also get them to stop making tor freely downloadable from the
> tor.eff.org web site, perhaps limiting downloads only to people who have
> passed a course on subjects you deem pertinent, so that the great unwashed
> will be "protected".

You seem to think people can just use Tor without understanding the 
issues. I guess maybe you think the "Warning: Want Tor to really work?" 
section should be removed from the Download page on tor.eff.org so it 
doesn't scare people out of using Tor? After all, it's better that 
people use Tor blindly and unsafely and perhaps without even realising, 
than not at all right? </sarcasm>

>      Yet again, I'd appreciate any *helpful* information regarding my two
> questions.  It would save me a lot of headaches getting to it by trial and
> error.

>      BTW, I didn't come up with the idea to provide wireless service to
> neighbors via tor.  I first read about it on this list, IIRC, where the
> person posting the start of that thread had an old 802.11b router that he
> wanted to put to use rather than add to his paperweight collection or
> whatever.  I've been thinking about it ever since I first read it here.
> People on this list seemed to have no problem with the idea then.  And this
> time, although a couple of people have voiced their dislike of the idea,
> no convincing arguments have yet been presented against the idea.

I didn't read that thread as far as I can remember. Go on then, who else 
thinks this is a good idea?

Read http://www.securityfocus.com/news/11486

Your users *will* fall prey to these sorts of attacks unless they know 
the exact implications of using your service, and how to do it safely.

Mike